{"id":"CVE-2026-10051","aliases":["DEBIAN-CVE-2026-10051","EUVD-2026-43645","GHSA-f4v5-65jj-pcr2","RHSA-2026:63327","RHSA-2026:63385","RHSA-2026:63386","RHSA-2026:63387","ROOT-APP-MAVEN-CVE-2026-10051","UBUNTU-CVE-2026-10051"],"status":"published","title":"Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00429,"percentile":0.37626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-07-14T08:44:38Z","modified":"2026-11-04T06:00:06Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["12.0.36","12.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.39-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["12.0.3-aikido.8","12.0.33-aikido.2","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9","12.0.33-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-server","fixed_in":["12.0.3-root.io.8","12.0.33-root.io.2","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9","12.0.33-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.35"},{"fixed":"12.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.9"},{"fixed":"12.1.10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1","12.0.40-1","12.0.40-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.39-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-5.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.73.30-3.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-5.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.73.30-3.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.18::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-aikido.8"},{"fixed":"12.0.33-aikido.2"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"},{"fixed":"12.0.33-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-root.io.8"},{"fixed":"12.0.33-root.io.2"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"},{"fixed":"12.0.33-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119","tags":["Vendor Advisory","Exploit","web","article","report"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10051","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/pull/15162","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/15163","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f4v5-65jj-pcr2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10051.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-10051","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63327","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511026","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-48474","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63327.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10051","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45363","tags":["advisory"]},{"url":"https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5988","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1611","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","tags":["article"]},{"url":"https://github.com/advisories/GHSA-72hv-8253-57qq","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13017","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13223","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63385","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-45592","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46105","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48574","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48584","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48585","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48586","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48587","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48588","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48589","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48628","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63385.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332","tags":["advisory"]},{"url":"https://github.com/ansible/ansible","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16493","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73622","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73623","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73624","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76221","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63386","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-46099","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48690","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48691","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48692","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48693","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48697","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-49372","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63386.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63387","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-42127","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45924","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48680","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63387.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-10051","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-10051","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.","status":"published","published":"2026-07-14T08:44:38.233Z","modified":"2026-07-14T12:57:50.096Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-43645","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.","status":"published","published":"2026-07-14T08:44:38Z","modified":"2026-07-14T12:57:50Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.206712Z"}],"ghsa":[{"id":"GHSA-f4v5-65jj-pcr2","title":"Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections","description":"### Description\n\n\u003e FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers)\n\u003e HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)\n\u003e \n\u003e Location:\n\u003e   jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/\n\u003e   HttpConnection.java:107, 1157-1161, 1170\n\u003e \n\u003e Detail:\n\u003e   _trailers (line 107) is a connection-scoped HttpFields.Mutable field.\n\u003e   parsedTrailer() (line 1157) populates it when request N carries HTTP trailers.\n\u003e   messageComplete() (line 1170) checks \"if (_trailers != null)\" — evaluates true\n\u003e   from request N's data — and stamps it onto request N+1.\n\u003e \n\u003e   Grep confirms: ZERO occurrences of \"_trailers = null\" in entire HttpConnection.java.\n\u003e \n\u003e   Scenario:\n\u003e     Request N:   POST /upload (trailers: X-Checksum: abc123)\n\u003e     Request N+1: GET  /data   (no trailers)\n\u003e     app: request.getTrailers() on N+1 → returns {X-Checksum: abc123} ← STALE\n\u003e \n\u003e   Application logic branching on getTrailers() != null produces incorrect behavior.\n\u003e   Not cross-connection (same keep-alive connection only).\n\u003e \n\u003e   More dangerous scenario: TOCTOU — trailer passes check, target swapped before use.\n\n### Workarounds\nDo not rely on HTTP request trailers for security-sensitive logic, or disable persistent connections by closing the connection after each HTTP/1.1 request.","status":"published","published":"2026-07-22T22:56:05Z","modified":"2026-07-22T22:56:08Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:51.375752Z"}],"nvd":[{"id":"CVE-2026-10051","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.","status":"published","published":"2026-07-14T09:16:39.783Z","modified":"2026-10-24T22:10:00.21Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"CVE-2026-10051","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.","status":"published","published":"2026-07-14T08:44:38.233Z","modified":"2026-10-28T02:30:58.402461022Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DEBIAN-CVE-2026-10051","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.","status":"published","published":"2026-07-14T09:16:39.783Z","modified":"2026-11-04T06:00:06.966324369Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T06:29:21.687524Z"},{"id":"GHSA-f4v5-65jj-pcr2","title":"Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections","description":"### Description\n\n\u003e FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers)\n\u003e HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)\n\u003e \n\u003e Location:\n\u003e   jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/\n\u003e   HttpConnection.java:107, 1157-1161, 1170\n\u003e \n\u003e Detail:\n\u003e   _trailers (line 107) is a connection-scoped HttpFields.Mutable field.\n\u003e   parsedTrailer() (line 1157) populates it when request N carries HTTP trailers.\n\u003e   messageComplete() (line 1170) checks \"if (_trailers != null)\" — evaluates true\n\u003e   from request N's data — and stamps it onto request N+1.\n\u003e \n\u003e   Grep confirms: ZERO occurrences of \"_trailers = null\" in entire HttpConnection.java.\n\u003e \n\u003e   Scenario:\n\u003e     Request N:   POST /upload (trailers: X-Checksum: abc123)\n\u003e     Request N+1: GET  /data   (no trailers)\n\u003e     app: request.getTrailers() on N+1 → returns {X-Checksum: abc123} ← STALE\n\u003e \n\u003e   Application logic branching on getTrailers() != null produces incorrect behavior.\n\u003e   Not cross-connection (same keep-alive connection only).\n\u003e \n\u003e   More dangerous scenario: TOCTOU — trailer passes check, target swapped before use.\n\n### Workarounds\nDo not rely on HTTP request trailers for security-sensitive logic, or disable persistent connections by closing the connection after each HTTP/1.1 request.","status":"published","published":"2026-07-22T22:56:05Z","modified":"2026-09-10T03:50:51.882727145Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"RHSA-2026:63327","title":"Red Hat Security Advisory: Satellite 6.16.13 Async Update","status":"published","published":"2026-09-04T10:14:01Z","modified":"2026-10-20T10:12:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63385","title":"Red Hat Security Advisory: Satellite 6.19.4 Async Update","status":"published","published":"2026-09-04T10:14:03Z","modified":"2026-10-20T10:12:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63386","title":"Red Hat Security Advisory: Satellite 6.18.9 Async Update","status":"published","published":"2026-09-04T10:14:03Z","modified":"2026-10-20T10:12:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63387","title":"Red Hat Security Advisory: Satellite 6.17.11 Async Update","status":"published","published":"2026-09-04T10:14:04Z","modified":"2026-10-20T10:12:59Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-10051","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.","status":"published","published":"2026-07-14T09:16:00Z","modified":"2026-10-17T12:58:40.910104834Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-10051","title":"CVE-2026-10051 in org.eclipse.jetty:jetty-server - Patched by Root","description":"Root has patched CVE-2026-10051 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-29T13:11:40Z","modified":"2026-09-29T14:15:02.972854638Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}